3c25f936d3
Add the foundation for distributing homelab context to every client (LXCs, VMs, workstations including republic-laptop, mac-mini, ludo-mini) with a single source of truth, structured query layer (MCP), and per-client age-key issuance for secrets: - inventory.yaml — canonical topology (hosts, services, mesh addresses) - hosts/*.yaml — per-host identity files generated from inventory by mcp/build_host_files.py; do not edit by hand - AGENTS.md — orientation doc symlinked to /root/AGENTS.md on every client - bootstrap.sh — one-shot enroll (Linux + macOS), clones repo, fetches age key from issuance, installs sync timer/launchd job, drops the homelab CLI - bin/homelab — single-binary Python CLI: whoami, list, ssh, pct, logs, restart, open, status, secret, sync, mcp, client add/remove, nuke - mcp/server.py — FastMCP server: context tools + read-only management tools (no mutations exposed); shell-outs use mcp-reader restricted ssh key - mcp/deploy/ — claudio-monitor-style gitea webhook deploy scaffold for the MCP service on LXC 105 (ports 9810 mcp, 9811 webhook) - secrets-issuance/ — per-client age key auto-provisioning over the mesh; source-IP gated against inventory, with denylist for revoked clients (ports 9820 issue, 9821 webhook) - secrets/, .sops.yaml — SOPS recipient scaffolding; the operator fills in age public keys after Phase 3a generates them - scripts/sync/ — systemd timer (Linux) + launchd plist (macOS) pulling /opt/homelab-context every 5 min Mesh: both Netbird (preferred, 100.122.0.0/16) and Tailscale accepted during the in-flight migration; no client is gated on completing the move. Plan reference: /root/.claude/plans/lets-make-a-plan-fluttering-trinket.md Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
42 lines
1.7 KiB
Bash
Executable File
42 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install the homelab-context sync mechanism for the current OS.
|
|
# Called by bootstrap.sh; safe to re-run (idempotent).
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="${HOMELAB_CONTEXT_DIR:-/opt/homelab-context}"
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
case "$(uname -s)" in
|
|
Linux)
|
|
install -m 0644 "$SCRIPT_DIR/linux/homelab-context-sync.service" \
|
|
/etc/systemd/system/homelab-context-sync.service
|
|
install -m 0644 "$SCRIPT_DIR/linux/homelab-context-sync.timer" \
|
|
/etc/systemd/system/homelab-context-sync.timer
|
|
systemctl daemon-reload
|
|
systemctl enable --now homelab-context-sync.timer
|
|
# Kick once so the first pull happens immediately.
|
|
systemctl start homelab-context-sync.service || true
|
|
echo "[install.sh] linux: timer installed and started"
|
|
;;
|
|
Darwin)
|
|
PLIST=/Library/LaunchDaemons/network.hubris.homelab-context-sync.plist
|
|
install -m 0644 -o root -g wheel \
|
|
"$SCRIPT_DIR/macos/network.hubris.homelab-context-sync.plist" "$PLIST"
|
|
# Touch the log path so the daemon can write without a TOCTOU.
|
|
touch /var/log/homelab-context-sync.log
|
|
chmod 0644 /var/log/homelab-context-sync.log
|
|
# bootstrap may have loaded a previous version; reload.
|
|
launchctl bootout system "$PLIST" 2>/dev/null || true
|
|
launchctl bootstrap system "$PLIST"
|
|
launchctl enable system/network.hubris.homelab-context-sync
|
|
# Kick once.
|
|
launchctl kickstart -k system/network.hubris.homelab-context-sync || true
|
|
echo "[install.sh] macos: launchd job loaded and kicked"
|
|
;;
|
|
*)
|
|
echo "[install.sh] unsupported OS: $(uname -s)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|